Unbounded memory growth in GStreamer rtph264depay and rtph265depay RTP depayloaders

This repository is a small standalone proof-of-concept for CVE-2026-18649, a remote denial-of-service issue in GStreamer's H.264 RTP depayloader (rtph264depay), with the README noting the same pattern also affects rtph265depay. The repository contains three files: a README describing the vulnerability, impact, and usage; a minimal requirements.txt stating only Python standard library and GStreamer prerequisites; and the main exploit script trigger.py. The exploit logic in trigger.py is straightforward and purpose-built. It creates a UDP socket and sends crafted RTP packets to a target port on 127.0.0.1. It first sends a valid H.264 FU-A start fragment, then continuously sends continuation fragments while never setting the FU end bit. Sequence numbers are incremented to keep packets looking valid. This causes the target depayloader to keep appending fragment data into its internal reassembly buffer without flushing, resulting in unbounded heap growth. The script optionally accepts a PID and monitors /proc/<pid>/status to report VmData growth and detect when the target process dies. The exploit is a real DoS exploit rather than a detector. It does not provide code execution or shell access; its sole capability is remote resource exhaustion against a vulnerable RTP-processing pipeline. The PoC is local by default because it targets 127.0.0.1, but the underlying vulnerability is network-reachable anywhere a vulnerable GStreamer RTP receiver is exposed. The code is concise, uses only Python's standard library, and is best classified as a proof-of-concept.